xloader | 1d07ba3818460950a41107248ebad65eea18efc3c151aa275be107732f3625d6

General

Target

1d07ba3818460950a41107248ebad65eea18efc3c151aa275be107732f3625d6.exe
Size

703KB
MD5

3ea0aeb40da1e753c6b9ce2981d25e51
SHA1

3e28a132b435a95adfe9339f93556a78a4d0f41f
SHA256

1d07ba3818460950a41107248ebad65eea18efc3c151aa275be107732f3625d6
SHA512

cd45ff5a4aab4ff7c1d40c0554401c9170a61407df0e23f11f85a28b5733cd504a2c947e858639656b45edd968e544d2358ac350673b0fe384ef8ad641e8a592

Score

10^/10

xloader pufi loader rat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

pufi

C2

http://www.homestechs.com/pufi/

Decoy

fusiongroupgames.net

hugevari.com

rebeccagriffiths.com

trocaoferta.com

theslashapp.com

codezonesoftware.xyz

sottocommunications.com

minicreators.online

course2millions.com

hfm5n1dhkjqwpe.xyz

xlab-ub.com

silvanaribeirocake.com

thefabinteriordesign.com

mg-leadership.com

petbort.com

ndust.net

203040302.xyz

jakital.com

shophuunghia.info

rednacionaldejuecesrd.net

Signatures

Xloader
Xloader is a rebranded version of Formbook malware.
loader xloader

Xloader Payload 2 IoCs

rat

Processes:

resource	yara_rule
behavioral1/memory/1588-124-0x0000000000400000-0x0000000000429000-memory.dmp	xloader
behavioral1/memory/1588-125-0x000000000041D450-mapping.dmp	xloader

Suspicious use of SetThreadContext 1 IoCs

Processes:

1d07ba3818460950a41107248ebad65eea18efc3c151aa275be107732f3625d6.exe

description	pid	process	target process
PID 2780 set thread context of 1588	2780	1d07ba3818460950a41107248ebad65eea18efc3c151aa275be107732f3625d6.exe	1d07ba3818460950a41107248ebad65eea18efc3c151aa275be107732f3625d6.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

1d07ba3818460950a41107248ebad65eea18efc3c151aa275be107732f3625d6.exe

pid	process
1588	1d07ba3818460950a41107248ebad65eea18efc3c151aa275be107732f3625d6.exe
1588	1d07ba3818460950a41107248ebad65eea18efc3c151aa275be107732f3625d6.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

1d07ba3818460950a41107248ebad65eea18efc3c151aa275be107732f3625d6.exe

description	pid	process	target process
PID 2780 wrote to memory of 1588	2780	1d07ba3818460950a41107248ebad65eea18efc3c151aa275be107732f3625d6.exe	1d07ba3818460950a41107248ebad65eea18efc3c151aa275be107732f3625d6.exe
PID 2780 wrote to memory of 1588	2780	1d07ba3818460950a41107248ebad65eea18efc3c151aa275be107732f3625d6.exe	1d07ba3818460950a41107248ebad65eea18efc3c151aa275be107732f3625d6.exe
PID 2780 wrote to memory of 1588	2780	1d07ba3818460950a41107248ebad65eea18efc3c151aa275be107732f3625d6.exe	1d07ba3818460950a41107248ebad65eea18efc3c151aa275be107732f3625d6.exe
PID 2780 wrote to memory of 1588	2780	1d07ba3818460950a41107248ebad65eea18efc3c151aa275be107732f3625d6.exe	1d07ba3818460950a41107248ebad65eea18efc3c151aa275be107732f3625d6.exe
PID 2780 wrote to memory of 1588	2780	1d07ba3818460950a41107248ebad65eea18efc3c151aa275be107732f3625d6.exe	1d07ba3818460950a41107248ebad65eea18efc3c151aa275be107732f3625d6.exe
PID 2780 wrote to memory of 1588	2780	1d07ba3818460950a41107248ebad65eea18efc3c151aa275be107732f3625d6.exe	1d07ba3818460950a41107248ebad65eea18efc3c151aa275be107732f3625d6.exe

C:\Users\Admin\AppData\Local\Temp\1d07ba3818460950a41107248ebad65eea18efc3c151aa275be107732f3625d6.exe
"C:\Users\Admin\AppData\Local\Temp\1d07ba3818460950a41107248ebad65eea18efc3c151aa275be107732f3625d6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2780

C:\Users\Admin\AppData\Local\Temp\1d07ba3818460950a41107248ebad65eea18efc3c151aa275be107732f3625d6.exe
"C:\Users\Admin\AppData\Local\Temp\1d07ba3818460950a41107248ebad65eea18efc3c151aa275be107732f3625d6.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1588

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1588-124-0x0000000000400000-0x0000000000429000-memory.dmp

Filesize
164KB

Download
memory/1588-125-0x000000000041D450-mapping.dmp

Download
memory/1588-126-0x0000000001190000-0x00000000014B0000-memory.dmp

Filesize
3.1MB

Download
memory/2780-115-0x0000000000570000-0x0000000000571000-memory.dmp

Filesize
4KB

Download
memory/2780-117-0x00000000052A0000-0x00000000052A1000-memory.dmp

Filesize
4KB

Download
memory/2780-118-0x0000000004E80000-0x0000000004E81000-memory.dmp

Filesize
4KB

Download
memory/2780-119-0x0000000004DA0000-0x000000000529E000-memory.dmp

Filesize
5.0MB

Download
memory/2780-120-0x0000000004FE0000-0x0000000004FE1000-memory.dmp

Filesize
4KB

Download
memory/2780-121-0x00000000051D0000-0x00000000051D7000-memory.dmp

Filesize
28KB

Download
memory/2780-122-0x0000000008720000-0x0000000008721000-memory.dmp

Filesize
4KB

Download
memory/2780-123-0x00000000088C0000-0x000000000890C000-memory.dmp

Filesize
304KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads